Recently active topics

The Featured Content microservice powering the Unified UI appears to be improperly evaluating identity mapping. Because our namespaces are defined but user enforcement is turned off, the API fails to route unscoped global curated rules to the frontend, resulting in a 403.Architecture: Multi-tenant environment using namespaces (Customer A, Customer B) for logical isolation.Current State: Data Access Paradigm Enforcement is currently Disabled/Inactive as our unified analyst team manages all clients globally.Troubleshooting Already Performed:Verified the user has the required legacy permissions (chronicle.curatedRules.*, chronicle.curatedRuleSets.*). The standalone "Curated Detections" tab loads and functions perfectly. Verified the user has the required new permission (chronicle.featuredContentRules.list) attached to their custom Alpha role. 

When you set up an Azure feed in Google SecOps, you copy a credential into the config — a storage account key, or an Event Hub connection string. By default, that credential has a problem: no IP restriction, no expiry, and full rights to the resource it came from.So if it ever leaks — a screenshot in a ticket, an old wiki page, a CI log — anyone who finds it can use it from anywhere on the internet until you rotate it.The fix is simple: put a network firewall on the Azure resource and only allow Google's IP ranges through.After that, the credential still works, and your feed keeps running — but it's useless to anyone outside Google's address space. That removes basically all the opportunistic risk.How it works, in three moves:Turn on the Azure firewall (deny by default) on the Storage Account or Event Hub Namespace that backs your feed. Allow-list Google's published IP ranges from https://www.gstatic.com/ipranges/goog.json. Set up a monthly refresh, because that list changes over time.

Hello everyone,I'm trying to build a Google SecOps SOAR integration with Freshdesk using HTTPv2.My goal is to automatically create a Freshdesk ticket when a case is moved to either:Investigation ResearchI created an Alert Playbook with a Custom Trigger configured as: [Case.Stage] = InvestigationOR[Case.Stage] = Research The playbook contains a simple HTTPv2 action that should create a ticket in Freshdesk.The playbook is enabled and saved. I also verified that the case stage is successfully changed, for example:"Case stage set to Investigation"However, the playbook never executes when the case stage changes.From the documentation and community posts, I understand that Alert Playbooks can access Case fields (Case.Stage, Case.Name, Case.Tags, etc.), but I'm not sure whether a Case Stage change is actually considered a trigger event for an Alert Playbook.My questions are:Can an Alert Playbook be triggered directly by a Case Stage change? Is a Case Stage change only evaluated when a new ale

Hi everyone, I have a feature proposal that I believe would greatly benefit our workflows.Every SOC team relies heavily on documentation. On any given day, we need quick access to: Playbooks and Standard Operating Procedures (SOPs) Guides and how-tos Internal systems documentation Detailed reporting for major incidents Reference lists The list goes on We all want Google SecOps to truly function as a "single pane of glass" for our analysts. Currently, forcing them to context-switch and jump between SecOps and external tools like Loop, OneNote, Confluence, or an external wiki breaks focus and disrupts the workflow.Implementing a simple, native Markdown-based wiki directly into Google SecOps seems like a straightforward solution with massive benefits. Having all security-critical documentation residing in the primary operational tool would be incredible.Imagine the potential: you could even search and automatically pull relevant internal documentation directly into specific case

Hey everyone, You might have caught our recent announcement introducing Google AI Threat Defense. As attackers increasingly leverage AI to find and exploit vulnerabilities at machine speed, human-speed patching simply can't keep up. The core of the new platform is about moving from a reactive posture to a continuous, autonomous defense. Instead of just generating a massive list of alerts, it actively prioritizes your most critical real-world risks and helps automate the remediation process.But what does this actually mean for those in the trenches running SIEM and SOAR? This shift to an "Agentic SOC" will impact the daily workflows for SOC analysts. And instead of just bolting an AI chatbot onto legacy tools, Google SecOps has specialized AI agents to handle the heavy lifting and manual toil across your operations:Detection engineering agent Triage and Investigation agent Threat hunting agent Agentic automation (combines dynamic AI agents)In particular, our Detection Engineering Agent

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random analysts.We have only 2 options when i create a manual action from dropdown list. You make that required parameter as MANDATORY. Then you have to give a DEFAULT VALUE when you are implementing it. If you give default value then when it is live, its showing that, action in playbook already filled with your default parameter, just like below image, and you can just press EXECUTE button as an analysts without choosing it. Which we dont want. You make that required parameter as NON-MANDATORY Then when its live playbook will gonna show you a dropdown list, that has “Choose” placeholder on top of it by default.(no real picture but it is just like at “Assign to” option below) Bc the parameter is NOT MANDATORY, then it means it is executable without ch

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with CrowdStrike? We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.  

I am trying to build a SOAR playbook where in I will have a condition block, which if answered “Yes” will continue to the next block, and if ansered “No” that it will repeatedly ask the same question again and again, how do I achieve this ?  

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research?e=48754805 PRC-nexus actors spent 15 months inside US medical research networks. Here's what your SOC should hunt for tonight.Google's threat intel team just published the UNC6508 campaign — and it's a masterclass in patient, quiet espionage against a sector most of us under-monitor: medical research, academic centers, and military health institutions across North America.The tradecraft is the lesson here,

This blog post was written by guest author, Eliraz Oved.  If you spend your days in the trenches of a Security Operations Center, you already know the struggle: pivoting between screens, writing complex queries, and manually clicking through menus to create rules or check feed health.Recently, Google dropped something that has the potential to completely change this workflow: the Google SecOps MCP (Model Context Protocol) Server, which officially supports Claude.For those new to the term, think of MCP as a universal, open -source API standard that gives AI models secure, structured access to external tools and data sources. Instead of just chatting with a static knowledge base, MCP servers equip the LLM with real-world tools, allowing it to fetch live data, analyze logs, and actively execute commands against backend services.A quick note before we dive in: because MCP is an open standard, you aren't locked into a single AI ecosystem. While we are using Claude (via the Claude Code CLI)

Hello Team,I am writing a rule to detect unknown IPs hitting our public-facing domains. In this rule, I only want to generate an alert when the source IP is not present in GCTI.The reason is that we already have a separate rule that handles IPs found in GCTI, so I want to avoid duplicate detections.Could someone please advise on the best way to implement a “NOT IN GCTI” condition within the rule?Is the below approach the correct way to verify that the principal IP generating the alerts is not present in GCTI? Also, is using the join with entity.ip the correct method for this check? 

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

Author :Vesselin Tzvetkov, Principal Security Engineer and Security Advisor  SIEM migrations are difficult tasks that take significant resources and time to conclude, as companies often accumulate thousands of custom rules on SIEM systems like ArcSight, QRadar, Splunk, and Azure Analytics. It is logical to ask: can we automate this migration? This blog will guide you through practical tools and approaches for automating rule migration.Migration is a huge undertaking, and here we will focus only on existing rule migration. If you want to see a holistic view covering ingestion, parsers, and playbooks, please look at SIEM Replacement | Google Cloud, SIEM migration guide | Google Cloud, and the Next ‘26 Solution session: SecOps large scale migrations steps and leveraging GenAI to accelerate. A translation of existing rules in YARA-L  generally consists of the following steps, and I will show you how to leverage an AI helper to execute them:  Mapping existing customer rules to SecOps curate

Blog Authors:Sumit Patel, Regional Security Architect, Google CloudKajan Moorthy, Staff Solutions Engineer, Cribl  In a perfect world, every security log would be indexed, searchable, and instantly available in your SIEM. In the real world, data is fragmented across cloud buckets, cold storage, and remote endpoints. Moving all that data just to see if it’s "interesting" is often too slow and too expensive.By using Google SecOps SOAR as the orchestration brain and Cribl Search as the remote query engine, analysts can hunt for threats across their entire infrastructure without moving a single byte of data until they need it.Where Cribl and Cribl Search FitCribl is a telemetry data platform built to help IT and security teams collect, transform, route, store, and analyse telemetry with more flexibility and less operational overhead. It also gives teams the ability to route data to multiple destinations at once, so they can send the right data to the right tools without duplicating collect

Hi everyone. I am working on enabling curated detections via composite detections. One issue that I have not been able to figure out yet so far is, is there a UDM value that defines whether a curated detection rule is broad or precise? I looked at the meta fields of the curated detections and used the network inspection tool as well to look at the actual json format. So far I have not been able to find such a field.My usecase is to write separate composite detections for precise curated detections and broad curated detections. I have a rule that consumes detections from curated detections but, as far as I know, it is not possible to distinguish whether these detections come from precise or broad rules. Thanks in advance.

Hi All,I am configuring the ServiceNow integration in Google SecOps / Chronicle SOAR, and the Test Connectivity action is failing with the following error:Exception: User Not Authorized----------------- Main - Finished -----------------status: 2result_value: Falseoutput_message: Connection Failed. Error is User Not AuthorizedFrom the logs, the integration appears to be trying to access the incident table using:GET https://<masked-instance>.service-now.com/api/now/v1/table/incident?sysparm_limit=1The response is:403 Client Error: ForbiddenMy current configuration is:API Root: https://<masked-instance>.service-now.com/api/now/v1/Incident Table: incidentAuthentication: <Basic/OAuth>Integration Version: ServiceNow V58.0The credentials seem to be accepted, but the user appears to be blocked by permissions, roles, or ACLs when trying to read the incident table.Has anyone faced this issue before? Which ServiceNow roles or ACLs are required for the integration user to success

In this webinar, Security, SecOps and AI Expert, Dave Nehoda, focuses on the critical security risks associated with deploying AI agents in Google Cloud Platform (GCP). Specifically, highlighting how prompt injection attacks can be leveraged to hijack an agent's GCP service account, leading to full infrastructure compromise and data exfiltration. The session provides a comprehensive blueprint for a 4-layer defense architecture using Model Armor, GCP Cloud Logging, Google SecOps, and SOAR to detect anomalous agent behavior and automatically contain threats in minutes. What You Can ExpectIn this webinar, you can expect to learn how to: Understand the true threat of prompt injection and how it acts as an infrastructure vulnerability that allows attackers to hijack service accounts and their IAM permissions. Minimize the blast radius of compromised AI agents by implementing critical IAM best practices, such as using dedicated service accounts, avoiding project-wide roles, and utilizing s

Authors:Bernie Weidel, Security Advisor, Google Cloud SecurityIvan Ninichuck, Google Cloud, Technical Solutions Engineer Introduction:Security Orchestration, Automation, and Response (SOAR) has long promised to alleviate alert fatigue and streamline incident response. However, for many Security Operations Centers (SOCs), the reality of SOAR adoption involves a steep learning curve. Building effective playbooks traditionally requires a deep understanding of proprietary visual editors, JSON payload parsing, and API data structures.The introduction of the Gemini playbook building assistant in Google SecOps fundamentally shifts this paradigm. By leveraging Google’s security-tuned Large Language Models (LLMs), security engineers and analysts can now translate natural language intent directly into functional, complex automation workflows.This technical adoption guide provides a blueprint for experienced Google SecOps users to operationalize the Gemini playbook assistant, transition away from

This weeks update is brought to you by Chris Martin, Google Security Specialist.  Discover the latest updates in Google SecOps for the week of June 8 through June 14, 2026. What’s New in Google SecOps, June 14th 2026 Highlights 🎉 Search case and case_history in UDM Search is now available😎 A great article from Sumit Patel on Integrating Google SecOps into Gemini Enterprise using Custom MCP💡 Explore several interesting features in the Bindplane monthly June roundup Product Updates & New Features Google SecOps 🚀 Release Notes from Google Cloud DocumentationJune 13, 2026: Google SecOps has introduced a new detection category, ‘Non-prioritized IoC Matching rules,’ within its Curated Detections feature, leveraging IoC feeds and threat intelligence to identify malicious activities. [Read More]New Non-prioritized IoC Matching Rules Category Non-prioritized IoC Matching rules category overview | Google Security Operations | Google Cloud…These rules are not designed to be run in alertin

Hey everyone!I am working on setting up a multi-tenant dashboard in Google SecOps SIEM and could use some advice from the community.Right now, we are tracking specific entities: files, domains, and URLs. We want to find a clean way to separate this data so each tenant only sees their own information on the dashboard.I have two main questions:1. How are you handling multi-tenancy? What is the best way to structure dashboards in Google SecOps when dealing with multiple tenants for file, domain, and URL data?2. Is there a common field we can use for filtering? We are looking for a standard field where we can append the tenant's name to easily group and filter these specific entities. What fields do you recommend for this?Additionally, how should we handle deduplication across tenants? Should we deduplicate within each tenant's data separately, or is there a global deduplication strategy that works better when dealing with shared entities (like domains or URLs that might appear across mult

Hi, I’m referring to the config GCP console / Google SecOps / Ingestion / Custom export filter settingsAFAIK there are no Terraform support for having the export filter settings in IaC.Looks like there is no API for editing these either. Is this on a roadmap?

Authors:Rene Kolga, Google Cloud Confidential ComputingJens Albers, Fr0ntierX Confidential computing promises something radical: you can run workloads on infrastructure you don't trust, and prove it. AMD SEV-SNP encrypts VM memory with keys the cloud operator can't access. Remote attestation lets a client verify that specific code is running inside genuine hardware isolation. And RA-TLS  -  Remote Attestation Transport Layer Security  -  ties that attestation to a TLS connection, so the client knows it's talking directly to the attested workload and not to something pretending to be it.This @works. But most production RA-TLS deployments have a gap that undermines the guarantee: the TLS private key sits in guest memory where a runtime exploit can steal it.This post explains the gap, why it matters more than people think, and how SVSM (Secure VM Service Module) key isolation closes it. How RA-TLS WorksA proxy running inside a Confidential VM generates a TLS key pair at startup, computes